CVE-2026-0277 Prisma Access Agent: Improper Certificate Validation on iOS
An attacker can intercept VPN traffic via man-in-the-middle attacks due to improper certificate validation in the iOS Prisma Access Agent.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-0277?
CVE-2026-0277 is a medium-severity vulnerability in Palo Alto Networks Prisma Access Agent, published on 9 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic.
The Prisma Access Agent on Windows, macOS, Linux, Android and ChromeOS are not affected.
Weakness: CWE-295
Which versions are affected by CVE-2026-0277?
It affects 1 product.
Products include Paloaltonetworks Prisma Access Agent.
How do I fix CVE-2026-0277?
No fix has been published for CVE-2026-0277 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-0277 being exploited?
There is no known exploitation of CVE-2026-0277 in the wild and no public exploit code.
Other vulnerabilities in Palo Alto Networks Prisma Access Agent
- CVE-2026-0248 Prisma Access Agent: Improper Certificate Validation Vulnerability
- CVE-2026-0294 Prisma Access Agent: Local Privilege Escalation
- CVE-2026-0271 Prisma Access Agent: Local Privilege Escalation by Authorized Users
- CVE-2026-0246 Prisma Access Agent: Local Privilege Escalation Vulnerability
- CVE-2026-0247 Prisma Access Agent Endpoint DLP: Authorization Bypass Vulnerabilities
Sources
Also known as GHSA-pf7c-mm8v-94pp.